Dcerpc Inspection; Dcerpc Overview; Configuring A Dcerpc Inspection Policy Map For Additional Inspection Control - Cisco PIX 500 Series Configuration Manual

DCERPC Inspection

DCERPC Inspection
This section describes the DCERPC inspection engine. This section includes the following topics:
•
•

DCERPC Overview

DCERPC is a protocol widely used by Microsoft distributed client and server applications that allows
software clients to execute programs on a server remotely.
This typically involves a client querying a server called the Endpoint Mapper listening on a well known
port number for the dynamically allocated network information of a required service. The client then sets
up a secondary connection to the server instance providing the service. The security appliance allows the
appropriate port number and network address and also applies NAT, if needed, for the secondary
connection.
DCERPC inspect maps inspect for native TCP communication between the EPM and client on well
known TCP port 135. Map and lookup operations of the EPM are supported for clients. Client and server
can be located in any security zone. The embedded server IP address and Port number are received from
the applicable EPM response messages. Since a client may attempt multiple connections to the server
port returned by EPM, multiple use of pinholes are allowed, which have user configurable timeouts.

Configuring a DCERPC Inspection Policy Map for Additional Inspection Control

To specify additional DCERPC inspection parameters, create a DCERPC inspection policy map. You can
then apply the inspection policy map when you enable DCERPC inspection according to the
"Configuring Application Inspection" section on page
To create a DCERPC inspection policy map, perform the following steps:
Create a DCERPC inspection policy map, enter the following command:
Step 1
hostname(config)# policy-map type inspect dcerpc policy_map_name
hostname(config-pmap)#
Where the policy_map_name is the name of the policy map. The CLI enters policy-map configuration
mode.
(Optional) To add a description to the policy map, enter the following command:
Step 2
hostname(config-pmap)# description string
Cisco Security Appliance Command Line Configuration Guide
25-12
B - initial SYN from outside, C - CTIQBE media, D - DNS, d - dump,
E - outside back connection, F - outside FIN, f - inside FIN,
G - group, g - MGCP, H - H.323, h - H.225.0, I - inbound data,
i - incomplete, J - GTP, j - GTP data, k - Skinny media,
M - SMTP data, m - SIP media, O - outbound data, P - inside back connection,
q - SQL*Net data, R - outside acknowledged FIN,
R - UDP RPC, r - inside acknowledged FIN, S - awaiting inside SYN,
s - awaiting outside SYN, T - SIP, t - SIP transient, U - up
DCERPC Overview, page 25-12
Configuring a DCERPC Inspection Policy Map for Additional Inspection Control, page 25-12
Chapter 25 Configuring Application Layer Protocol Inspection
25-5.
OL-12172-03